#!/usr/bin/perl
use strict;
use Win32::EventLog;

my $emailAddys = "email@address.org";
my @systems    = "test.system.org";

foreach my $system (@systems) {
   print "processing $system\n";
   my %event = ('Length',          "",
                'RecordNumber',    "",
                'TimeGenerated',   "",
                'TimeWritten',     "",
                'EventID',         "",
                'EventType',       "",
                'Category',        "",
                'ClosingRecordNumber', "",
                'Source',          "",
                'Computer',        "",
                'Strings',         "",
                'Data',            "",
                );

   # retrieve the full text of every message on each Read()
   $Win32::EventLog::GetMessageText=1;

   my $event       = "";
   my $EventLog    = "";
   my $numEvents   = 0;
   my $oldestEvent = 0;
   my @errors;
   my @warnings;
   my @statistics;

   foreach my $AppType (qw(Application Security System)) {
      my $queryResult = Win32::EventLog::Open($EventLog, $AppType, $sy
+stem);
      if (!($queryResult)) {
          print "Could not open $AppType log for $system:$^E\n";
          next;
      }

      $EventLog->Win32::EventLog::GetNumber($numEvents);
      $EventLog->Win32::EventLog::GetOldest($oldestEvent);

      $EventLog->Win32::EventLog::Read((EVENTLOG_SEEK_READ |
                                        EVENTLOG_FORWARDS_READ),
                                        $numEvents + $oldestEvent, $ev
+ent);

      # loop through all of the events, recording the number of Source
+ and
      # EventTypes

      my %source;
      my %types;

      for ($i=0; $i<$numEvents; $i++) {
           $EventLog->Read((EVENTLOG_SEQUENTIAL_READ |
                            EVENTLOG_FORWARDS_READ),
                            0, $event);
           $source{$event->{Source}}++;
           $types{$event->{EventType}}++;

           if ($type{$event->{EventType}} =~ /error/i) {
               push @errors, "$event->{TimeGenerated}: " .
                             "$event->{EventID}: " .
                             "$event->{Source}: " .
                             "$event->{Message}\n";
           }
           elsif ($type{$event->{EventType}} =~ /warning/i) {
               push @warnings, "$event->{TimeGenerated}: " .
                             "$event->{EventID}: " .
                             "$event->{Source}: " .
                             "$event->{Message}\n";
           }
      }
      $EventLog->Close();
   }
   use Mail::Sendmail;

   my %mail = ( To      => "$emailAddys",
                From    => "stephen.hargrove\@ttuhsc.edu",
                Subject => "$system Event Log Summaries",
                Message => "@errors"."@warnings",
               );
   $mail{smtp} = 'smtp.server.org';

   sendmail(%mail) or die "\nDoh! $Mail::Sendmail::error\n";

   undef @errors;
   undef @warnings;
}
[download]

$event->{TimeGenerated}, as near as I can figure, is always correct, as is $event->{Source}. However, as mentioned, $event->{EventID} will sometimes return a valid event code and other times will return something like -2147483646. In these instances, $event->{Message} is (understandably) blank.

As a side note, any time the returned event code is invalid, it's always negative.

Any ideas on what I might be doing that would cause Win32::EventLog to return these type of oddities?

Thanks.

If things get any worse, I'll have to ask you to stop helping me.